Re: SSH Blocking
On Mon, 2005-04-25 at 09:42 -0500, Nick Miller wrote:
> Hello All,
>
> I maintain a couple of exim mail servers on the Internet and I have
> noticed that a lot of people will try to gain access to these machines
> by trying multiple SSH logins with all sorts of names. I am wondering if
> there is an option in SSHD to block an IP after a certain amount of
> failed login attempts as any user?
I haven't done that yet, but I did this.
In /etc/ssh/sshd_config, set MaxStartups to a low number, say 2. There
is another option that specifies how long sshd waits before returning
the lonin prompt after a failed attempt, but for the life of me I can't
find it now. If you set this option to something high, like 600
seconds, an attacker will only be able to try twice in ten minutes.
In adition, setting PermitRootLogin to "no" will make it much harder.
Most of the ssh bruteforce scripts I've seen, tries to log in as root,
so this makes most of them useless.
--
Kind regards
Hans du Plooy
SagacIT (Pty) Ltd
hansdp at sagacit dot com
Reply to: